commit c3c69bed0f76178c640dd8e726967b9cdea5dece
author akirilov <akirilov@google.com> Mon May 21 11:45:55 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jul 20 00:20:27 2018 +0000
tree d10ef4089f36fa230cd148cb99d049176eab257f
parent 3a2799939b2da543ed3a62f29db658cb05f8ad3b

RESTRICT AUTOMERGE: Fixes two bluetooth causing remote overreads (2/2)

Bug: 74075873
Test: manual
Change-Id: I9a7035a74aca3256c5712ea67a7435627b139c37
(cherry picked from commit 9d647b201b64949e04eade9b594af76c764dbb96)

stack/sdp/sdp_discovery.cc

diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc
index f5dab6e..bf6f43b 100644
--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -332,7 +332,7 @@
  ******************************************************************************/
 #if (SDP_RAW_DATA_INCLUDED == TRUE)
 static void sdp_copy_raw_data(tCONN_CB* p_ccb, bool offset) {
-  unsigned int cpy_len;
+  unsigned int cpy_len, rem_len;
   uint32_t list_len;
   uint8_t* p;
   uint8_t type;
@@ -360,6 +360,11 @@
     if (list_len < cpy_len) {
       cpy_len = list_len;
     }
+    rem_len = SDP_MAX_LIST_BYTE_COUNT - (unsigned int)(p - &p_ccb->rsp_list[0]);
+    if (cpy_len > rem_len) {
+      SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);
+      cpy_len = rem_len;
+    }
     SDP_TRACE_WARNING(
         "%s: list_len:%d cpy_len:%d p:%p p_ccb:%p p_db:%p raw_size:%d "
         "raw_used:%d raw_data:%p",